question

LITRS-5211 avatar image
0 Votes"
LITRS-5211 asked LITRS-5211 answered

Migrate AD User and AADConnect to new Forest (Same O365 tenant)

Hi guys,


Over the last few weeks i've been reading a lot around Tenant-to-tenant migration, and we've been playing around with the new features and it's been pretty cool.

BUT, I have a question around migrating AD User Objects and standing up a new AADConnect server in a new environment but still syncing into the SAME Azure AD & O365 tenant.

(NOT a new tenant. Same tenant, but Source of Authority is now a new AD Forest and a new AADConnect Server)

So in summary:


Current Set up:

  • On-Premise Active Directory (AD users) in Forest A

  • All users are synced via AAD Connect server in Forest A

  • Hybrid with Exchange 2016 in Forest B (two-way trust with Forest A)

  • All mailboxes are migrated to Exchange Online


Target Set up:

Due to Business reasons (change in datacentre/supplier), we want to continue to use the existing O365 Tenant and Azure subscription, but need to migrate AD Objects (Source of Authority) and stand up a new AAD Connect server to sync the AD objects to the migrated mailboxes in the environment.


So the Target environment would look like this:


  • All AD Users (source of authority) are in Forest C (We will set up a Two-Way trust with Forest A)

  • The AADConnect server to sync all objects to the O365 tenant will also need to be stood up in Forest C

  • The EXO mailboxes in O365 should not be impacted.


AFAIK, there is limited documentation around this online, but if anyone has any experience around this, have used any articles, or can think of any gotchas, would be good to get your views.

I've done something similar with a few previous customers so have a high-level idea but would be good to see if anyone has done this - I know it will require an AD Migration cross-forest (maybe ADMT/3rd party like Quest) and I guess the UPN's will change for the users, but more around planning (coexistence/phased vs. cutover). etc.

UPDATE: No need for AD user objects to be migrated; customer has manually re-created the AD user objects in their Target AD environment and they have given the users new laptop devices in the new target AD environment.
As all mailboxes are migrated to Exchange Online and there are no mailboxes on-premises, Autodiscover DNS points to autodiscover.outlook.com - Therefore, when the user logs in to their new laptop device, their Outlook client profile is manually configured to point to Exchange Online.

Thanks

Ron




azure-active-directoryoffice-exchange-online-itproazure-ad-connectoffice-exchange-hybrid-itproazure-ad-hybrid-identity
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi, do you still require assistance? If not, please mark the answer as verified.

Thank you,
James

0 Votes 0 ·
LITRS-5211 avatar image LITRS-5211 JamesHamil-MSFT ·

Hi James, yes still require assistance

0 Votes 0 ·
NiklasN avatar image
1 Vote"
NiklasN answered NadimJ-8941 published

Hi Ron,

just high level but should work:

  1. Create Domain for Forest C in O365

  2. decomission Hybrid in Forest B, set MX and Autodiscover to Cloud if not done already

  3. Migrate AD Accounts to Forest C (ADMT prefered in case you just need to do a "silly" User migration)

  4. Stop AD Connect on Forest A

  5. Ensure you have "Cloud only" accounts in O365

  6. Switch only UPN in O365 to newly created domain from forest C (in case Email should be also switched to new Domain, prepare youre AD Objects and edit "e-mail" Attribut

  7. Install AD Connect on Forest C

  8. Start Syncing

  9. AD Connect should do a softmatch then

  10. install minimal Hybrid on Forest C (just in case you need GUI for administration) (i know, administration via Attribut Editor is not supported by MS but works very well, so maybe a Exchange is not needed)

  11. be happy :)

iam not quite sure, but when you migrate Users they normally got devices (AD Computer Objects) which need also be migrated. So i guess you will do a coexistance szenario: in that case i would do it in a staged migration: Move users in Forest A to a OU which is not synced to O365. They will be deleted in O365 and you can recover them from recycle bin and then they will be a "cloud only" user. For faster restoring you could use PS Script (additionally in this script you could also change the UPN to the Forest C domain) for that. Meanwhile you can migrate this users with ADMT to new domain and let them sync with the newly installed AD Connect in Forest C


Best
Niklas











5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KhurramRahim avatar image
0 Votes"
KhurramRahim answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KhurramRahim avatar image
1 Vote"
KhurramRahim answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LydiaZhou-MSFT avatar image
3 Votes"
LydiaZhou-MSFT answered LITRS-5211 commented

@LITRS-5211

Do you mean forest A is the account forest, and mailboxes migrated to O365 are linked mailboxes in forest B?

The steps provided by NiklasN should be correct. However, if you just want to manage mailboxes from on-premises and hybrid features are not needed, we don't have to deploy the hybrid configuration. Also, we have to extend AD schema for Exchange in forest C for some Exchange attributes.
For your reference: To disable directory synchronization and uninstall Exchange hybrid.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@LITRS-5211

Just checking in to see if above information was helpful. If you have any questions or need further help on this issue, please feel free to post back.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·

@LITRS-5211

Any updates so far?
If you have solved your problem, could you share with us? Maybe it will help more people with similar problems.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·

Hi Lydia, yes I have updated below

0 Votes 0 ·
LITRS-5211 avatar image
0 Votes"
LITRS-5211 answered LydiaZhou-MSFT commented

Do you mean forest A is the account forest, and mailboxes migrated to O365 are linked mailboxes in forest B?

@LydiaZhou-MSFT
Hi Lydia, Thanks for your reply. Correct - They've got their Enabled AD User objects in Forest A and have the Exchange Hybrid set up in Forest B, therefore linked mailboxes which have (99% or all) been migrated to Exchange Online.

I appreciate that we can only have one primary AADConnect server per Azure tenant, so do you have any thoughts on how we would go about configuring a new AADConnect Server in Forest C (the new forest) and connected to sync to the same Azure O365 tenant? I was thinking maybe something like:

  • 2-way Trust in place between Forest A and Forest C

  • Install a new AADC instance as a Staging Server in Forest C

  • Replicate the in-scope OU's and Security Groups that are in AADC in Forest A (Active) to AADC in Forest C (Staging)

  • Switchover Staging in Forest C as Primary

  • Later on, remove the Forest A (now Staging) AADC server from farm?

Thoughts?

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

In general, we suggest to use ADMT to migrate AD accounts. We don't have to install AAD Connector in forest A and C at the same time.

We can remove hybrid configuration in forest B and remove AAD connector in forest A, make sure all mailboxes and accounts are only in O365. Then migrate AD accounts from forest A to C. After that, install AAD connector to do the softmatch.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·
LITRS-5211 avatar image
0 Votes"
LITRS-5211 answered

Hi LydiaZhou,

So an update for you (and for any one else interested in this).
We have no access to the existing AADConnect environment
We don't also have access to the Forest A where the current AD accounts are.

  • The users have already been recreated in the target Forest C with new AD user objects. They're logged into their new AD user objects and new laptop devices in Forest C, but their new Outlook client profiles are manually configured for autodiscover.outlook.com because all mailboxes are already in Exchange Online.


Our objective is to disconnect the MSOL User object from the source Forest A user object and connect the MSOL user object to the new created user objects in the new Target AD.

So, plan is:

  1. Configure the AADConnect server in the Target AD environment as Staging Mode

  2. Create new Exchange hybrid server in the Target AD environment and set Service Connection Point (SCP) to $null

  3. Perhaps MINIMAL HCW? Because no need for rich coexistence

Thoughts?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NiklasN avatar image
0 Votes"
NiklasN answered

First of all i would disable the ADConnect Service in via Powershell:
Set-MsolDirSyncEnabled –EnableDirSync $false

Problem here is, if you enable it again, it will directly connect again with the existing ADConnect where you dont have Access to.
To Avoid this, try to delete the created Sync User in the Portal and then install your new AD Connect.

iam not quite sure if the Immutable ID´s will be deleted by deactivating the old Sync. Catch up one user and check that

Get-Msoluser -UserprincipalName blabla@bla.com | select ImmutableID

if its blank, its good. Then O365 thinks this user was never synced from a local AD
if its not blank, i would delete all of the ImmutableID´s from the Users.

Get-MsolUser | Set-MsolUser -ImmutableId $null
try this cmdlet first for one user to check if its working.

After that, set local UPN = Cloud UPN and your new ADConnect should do a Softmach then

You wrote, you created the Users from scratch. To be sure please doublecheck before syncing that no Exchange related Attributes like ExchangeGUID/MailboxGUID is set in the ADUser.

Happy Syncing :)










5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LITRS-5211 avatar image
0 Votes"
LITRS-5211 answered

Hi Niklas, thanks for this! @NiklasN

I have installed a new AADConnect server this week in Staging Mode.
I have added the users from Forest A into the scope (the ones that are being synced right now)
So hopefully - if I just enable staging mode on the current AADconnect server (by asking the old supplier to perform this change), then Azure AD should continue to be matched with the users from Forest A.

Then once we are comfortable that we can sync using the new AADConnect server with the on-prem AD user objects from Forest A, maybe then we can add the OUs of user objects from Forest C into scope, and then force the immutableID's?

"You wrote, you created the Users from scratch. To be sure please doublecheck before syncing that no Exchange related Attributes like ExchangeGUID/MailboxGUID is set in the ADUser."
I have installed Exchange 2016 into the new Forest C - but as of now, there is no mailbox (except my admin) or any mail contacts/users showing in the Exchange environment.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NiklasN avatar image
0 Votes"
NiklasN answered

"I have added the users from Forest A into the scope (the ones that are being synced right now) "

migrated (via Migration Tool) or just created new?

So hopefully - if I just enable staging mode on the current AADconnect server (by asking the old supplier to perform this change), then Azure AD should continue to be matched with the users from Forest A

if they have been migrated with the ObjectGUID the sync would work with ObejctGUID as source anchor in ADConnect. If they were newly created (from Scratch) they dont have the same ObjectGUID. That means no matching would work i guess.

Just for clarification: ADConnect is configured to use the ObjectGUID as source anchor. And if this objectGUID does not match with the cloud users immutableID, there is no matching. (NOTE: ObjectGUID = immutableID (the values look different because of base64 encoding))

You have two possibilities:

  1. get the objectGUID from the old source users, write this value to the ms-DSConsistencyGUID on the new User and set the source anchor in your newly added ADConncet to DSConsistencyGUID. Thats is important, because you cannot change ObjectGUID on existing users.

The easier way out of my point of view:

  1. Turn off the sync as described before, delete the Sync user ( similar: ADSyncUser423959291523912@tenantname.onmicrosoft.com) Tell the old supplier to remove the domain from ADConnect or just turn it of(if possible). Then delete the ImmutableID on the Cloud Users, Set UPN to the same as local (or vice versa) and then test the new ADConnect only with one User in the scope. If Softmatching works, you can add the rest of the users in sync scope.

Best,
Niklas


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LITRS-5211 avatar image
0 Votes"
LITRS-5211 answered

Hi @NiklasN
We have created new AD Users in Forest C.
We (with help of the outgoing supplier's credentials) have added Forest A (existing AD Users) domain to the new AADconnect server I have created in Forest C. We've also included the OU's into the scope to be synched, however at this moment our AADC is in Staging Mode, so unable to test.

Then, when we make our AADconnect server in Forest C as the primary (i'll disable staging mode), then i'll confirm that everything still works with Forest A's users syncing via my AADconnect Server in Forest C.

THEN - during out of hours, we'll add some users (one by one for testing) into scope to Sync from Forest C to Azure.

As we have created the users as new (instead of migration), I am aware that the ObjectGUId will be different, therefore I understand that I will have to manually hard match the ObjectGuid (Immutable ID) to the cloud user's account (set-msoluser -UPN XYZ -ImmutableID "XYZ")

My concern is that the custom domain (username@EXTERNALDOMAIN.COM) will be now synced from 2 on-premises Active Directory Forests (from Forest A and Forest C). Would I still be able to force a Hard Match or would it just simply not work?




5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.